Skip to main content
affpapa.org
RU EN
skill Claude Code CX Codex Cursor GitHub Copilot

semgrep — Claude Code skill: what it does, how to install

Runs a Semgrep static security audit on your codebase. It presents a plan for user confirmation and merges all findings into SARIF.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add trailofbits/skills --skill semgrep -a claude-code
Open on GitHub

What semgrep does

The skill runs static analysis across project files to detect security flaws. It identifies repository languages and checks whether Semgrep Pro is available. Every command enforces --metrics=off so scan data stays off remote telemetry servers.

Execution will not start without explicit user confirmation. The agent presents targets alongside rulesets from Trail of Bits, 0xdea, and Decurity, then waits for approval. The host environment must have the Semgrep CLI installed beforehand.

Two scan profiles are available: complete coverage or a filtered run targeting high-impact security findings. Running the open-source engine without a Pro license means cross-file taint analysis is skipped entirely, leaving inter-file data leaks undetected. Output files land in ./static_analysis_semgrep_1 and merge into results.sarif.

What it helps with

  • run a static security audit before code review
  • detect vulnerabilities with third-party rulesets like Trail of Bits and 0xdea
  • merge multi-ruleset Semgrep scan results into a single SARIF file
  • filter code findings by impact and confidence levels

Example prompts for the agent

  • Run a semgrep security scan on this project using important only mode
  • Scan this codebase with semgrep and save findings to ./static_analysis_semgrep_1
  • Perform a semgrep static analysis and wait for my plan approval

How to install semgrep

1Skills CLI (Vercel)

npx skills add trailofbits/skills --skill semgrep -a claude-code

2Manually: put the files in place

~/.claude/skills/semgrep/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/semgrep/

From the same set35

The whole set →
differential-review trailofbits Reviews code changes for security issues using Git history and test coverage. Use it for commits, diffs, and pull requests that need a written review report. Claude Code CX Codex Cursor +1 8,800installs modern-python trailofbits Configures Python projects with a modern tooling stack: uv for dependency management, ruff for linting and formatting, ty for type checking. Use when starting new projects, writing scripts, or migrating from legacy tools. Claude Code CX Codex Cursor +1 8,700installs secure-workflow-guide trailofbits Guides smart contracts through Trail of Bits' 5-step security audit on check-in or before deployment. It runs static analysis, generates visual charts, and prepares fuzzing tests. Claude Code CX Codex Cursor +1 7,400installs sharp-edges trailofbits Audits API designs and configuration schemas for developer footguns. Flags dangerous defaults and fragile interfaces where the easiest path causes security vulnerabilities. Claude Code CX Codex Cursor +1 6,900installs agentic-actions-auditor trailofbits Inspects GitHub Actions workflows for prompt injection risks and insecure AI agent setups. Catches attacker inputs leaking into prompts via event contexts or environment variables. Claude Code CX Codex Cursor +1 6,700installs gh-cli trailofbits A skill that redirects GitHub requests from curl and fetch to authenticated gh CLI for repositories, pull requests, and issues. Use it for private repos and higher API limits. Claude Code CX Codex Cursor +1 6,600installs variant-analysis trailofbits Finds related occurrences of an already identified defect across a repository. Use it after a vulnerability or logic issue turns up and similar code needs checking. Claude Code CX Codex Cursor +1 6,400installs sarif-parsing trailofbits Processes existing SARIF reports from CodeQL, Semgrep, and other scanners. Use it to filter findings, remove duplicates, or prepare results for CI/CD. Claude Code CX Codex Cursor +1 5,900installs

Similar

codeql official github Walks you through CodeQL code scanning: Actions workflows, CLI commands, SARIF output, and fixing failed analyses. GitHub Copilot 2,000installs omni-auth cheaper-inference Manage API keys and sessions in OmniRoute. Authenticates requests via Bearer tokens, handles dashboard login with password or OIDC, and controls session access. Claude Code CX Codex Cursor +1 1,100installs review-agent-setup Tom Farley This skill gates AI review actions behind manual human approval before pull requests or CI pipelines change. Every attempt generates an Ed25519-signed receipt for offline auditing. Claude Code CX Codex Cursor 5,200installs audit-website squirrelscan Runs squirrel CLI audits against a website, pinpoints SEO, performance, and security issues, and applies fixes directly to source code. Claude Code CX Codex Cursor +1 73,900installs google-cloud-filestore-log-troubleshooting official google Diagnoses Google Cloud Filestore mount failures, access errors, and network timeouts. Use it when an NFS share stops mounting from a VM, GKE pod, or another supported workload. Claude Code Gemini CLI CX Codex 1,600installs security-reviewer https://github.com/Jeffallan Finds code and infrastructure vulnerabilities, assigns severity ratings, and suggests fixes. Use it for audits, secret scanning, and dependency checks. Claude Code CX Codex Cursor +1 6,000installs git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. Claude Code 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. Claude Code CX Codex Cursor +1 56,300installs

Questions about semgrep

How to install semgrep in Claude Code?

Run npx skills add trailofbits/skills --skill semgrep -a claude-code in your terminal.

What does the semgrep skill do?

It identifies project languages, prepares a ruleset plan for user approval, runs Semgrep CLI scans in parallel, and merges all findings into a SARIF report.

What is the difference between open-source Semgrep and Semgrep Pro here?

Semgrep Pro adds cross-file taint tracking and extra language coverage, whereas the free open-source engine only inspects code within individual files.

See also

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor